We had a user leave and before he did he asked that I change the ownership of all his reports to another employee. I did that. Today I found out that he owns a lookup. When I look in knowledge objects orphans, it wasn't in there. From what I've found online, lookups are completely different. Is there anyway in Splunk to find everything a user owns? I would rather be proactive and find things the the user didn't mention, rather than wait for notification that something isn't working.
TIA,
Joe
The dashboard at Settings->All configurations should show everything a given user owns. Or you can try this query
| rest /servicesNS/-/-/directory splunk_server=local
| search eai:acl.owner="foo"
| rename eai:* as *, acl.* as *
| sort owner app type
| table owner sharing app title type location
The dashboard at Settings->All configurations should show everything a given user owns. Or you can try this query
| rest /servicesNS/-/-/directory splunk_server=local
| search eai:acl.owner="foo"
| rename eai:* as *, acl.* as *
| sort owner app type
| table owner sharing app title type location
Thanks @richgalloway for the solution. That does exactly what I need it to do.